{ "llm": { "conf": 0.99300003, "grade": "hostile", "model": "Qwen/Qwen3.6-27B", "outcome": "hostile", "interpretation": "ISO contains obfuscated .NET dropper" }, "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": 25, "conf": 92, "mods": [ { "cls": 0, "raw": 0.9650319, "rte": "az", "prob": 0.9650319 } ], "prob": 0.99, "files": [ { "id": 0, "lvl": 25, "conf": 92, "prob": 0.9900000095367432, "type": "iso" } ], "version": "v18.18", "analyzed_at": "2026-08-02T17:59:18Z" }, "path": "3167a32d075d3c38d0c30d274ff51bcb77a23d7465788e295a3553556403776a.iso", "raw": { "v": "8", "files": [ { "id": 0, "ctx": [ { "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR!GA:-\u003cbw[u0%AV!\u003egAa@-/ixeYLhY%j=arR^HarR^b00000000020rr91009c3000000000000000000000000000000000000000100032000312Nyzq00000000uu0000000000000=m0000y02$$s000008#{lA000080c[RZ1UQ}P0SSi30003203AybarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hao", "n": [ { "c": 5, "d": "ISO .NET reflection resource loader", "i": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader", "o": 32769, "z": 5, "cf": 0.9900000095367432 } ], "ln": 32641 }, { "b": "8%cesH#A0KE*WN1J#pEv\u003edFjJm3U=F6E$o^I$SrRzt6Q3ofaEU\u0026\u003cz7vKp(f6N!YZdR]WP8R8}G2Wp})G\u00261{FJLO5\u003eJno8=%u%+Gsp5=sr115VL+HFD\u00260v:J!iL7EPljS\u003eK\u0026}^3mR(+}E)+y+w0000\u003cmnumNlstxMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn97Q5fbyPQ)H!4HC+SC\u003e9bu5Y8x(mN800000rd$qLxS.snbumUxYFxM*5c8Xgbs+:9l\u0026Wh!+RGn1M(2/6bsli+vGlxd000000SSi3r#[1w2{fcE09Vf002tLm0rr91Z5Ocka]?PySSi20Ee%rF3JQkcO=F/\u003e5=.[im/\u0026U\u003csPwB45=.[iDh){B?2EAP6-Xjl0rr911][S61][S61POJ51POJ53\u0026*nc0SSi2007*=0rr91000GeI3[LI5=*n]\u003c01WcA$4yH1]].P@2MgBljJG03ihT^", "n": [ { "c": 5, "d": "ISO stages a .NET resource payload", "i": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager", "o": 436840, "z": 4, "cf": 0.9900000095367432 } ], "ln": 436712 }, { "b": "xjVf(q!o#)wPy*.A=U@kzuarXByd\u003c+z!a02Bxh%[B7]Mg06$Nyy?Wx/BzkVh0cqZ[uRCxFvruj4zu9mCw]zZbvruj4zu9QXB97#ge\u003c\u003cL{w[+[2A::67z/bLND2[7sz7Xs{z^)c\u003ex)Kifx(v\u003e?nP5SYA:-E1x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9TRwO1RPwmXbDy\u00260V)BzkVh06$:Hz:OCWAbo9cwM9X\u003ex(mMJz!%l3v@#B6zu94xzGG]qy^SbSy?m9#x(v\u003e?rbVX\u003eq/)4]A7Ld.z9@kTy?m9#x(v\u003e?l$7gCm@\u0026rOr+Vb?lVl^-zeIZVy\u00260V)BzkVh07R6FB-oY^y\u00260V)BzkVh08)(Np*[xMzdN*2AZK+Yy?m9#x(v\u003e?pHX6Iv@$7Ry\u00260V)BzkVh07pmqvn.2/lVl^SwN/*@z/bLyvrt{FA+P5+x\u003eqG^z*aM!y\u00260V)BzkVh083)GlVl^SwN/*@z/bLJwmx4oz/fD7v/", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 461339, "z": 17, "cf": 0.9399999976158142 } ], "ln": 461211 }, { "b": "0bV7gz/6DoBy/F*vRPE:BwN0@C4\u003eF#ASx@-o)G/KvPc\u0026UC4\u003eC$B5cmWwN/*UA=lbnwmY=Yzc{1.mSir:B5cmWwN/*UA=lbnwmY=Yq/)4]zF8pUx(4r\u003eASx3SwN/B.y^@tVwmY=YoMaARnn\u0026rPwPv=rz/6DizE)ZcqE%]/B-H#6o\u003c}{FxjV8-rbUuCBy/8@ASxJUwmYpxvqYQ(wPv=ux(4uKvqYQ(wPv=rz/fSmy?ldCzE^M{ASwEnzEWl]mrSlWBvY?TwnC*$08)MNByYrlzBF.WzGFATzE^M{ASw:zC%#)/zGFATzE^M{ASx3-B97#ge\u003c\u003cL/wKHDNe\u003c\u003cL]Aa%c1ASwV#z/fV9x(mH5090xoy?k$LzGGr3zE)?*rDz.(08)(Np*[xMzdN*2ASx3WA+eV@s8@1%wPv=(wPRoGx(4)5ASwKCBy/E)lVl*XB-.hn0b2\u003e+uU\u003cg/q!o#)wPv=(wPRo}vR!$OA=#2m0b2\u003e+uVZKmq!o#)wPv+", "n": [ { "c": 3, "d": ".NET resource loader marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-resource-loader", "o": 462786, "z": 15, "cf": 0.949999988079071 } ], "ln": 462658 }, { "b": "wKo*nyEr2Rz/L?^y\u0026\u00263.y\u0026ss]ze0)aASwEywNPQQA=kY7v@$dWA=k%#q!p5EA=kY7v@$dWA=k%#B7GD2lV)A\u003cz/L?\u003cwPRoXvqf*JB-ILwASx0GB9hqvp\u0026ZF:wPI{hASwW1zGP/cA::6dASwQvBvy7\u0026zdN-@Bz(g1l1t1JC42GhASv.4Bz(g1e[nykz/L?Lz/fohz/L?{uUjs}qEK(\u0026ASw%VpgW{SqEK(\u0026ASxY(vqPNLBAdvYnP5SDBAdvWD2[7sz7Xj\u003cvp%E@B98baA@Y\u0026:Byf0cz!0?*B7GD2Ab](bA@Y\u0026:BydHKwO+)#0cqZ[uQ!:vy?dO!xjVf(BAQb/wO+)#0cqZ[uVZDXx\u003eq9\u003eA@Y/^wO+)#08mfqA=l2qw]]Uax(!A9y^IMKx\u003e5+-wP?=$wPE\u0026Cx\u003e8g4B8LVje((XcBZY8Mvrlc)e\u003cTC}y?Wx/BzkVhq!o#)x\u003e7Z}08[e:By/qwqGV(0x(dAlnP5SYA=k[}wPz%dv/", "n": [ { "c": 3, "d": ".NET reflection marker in opaque content", "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "o": 463269, "z": 9, "cf": 0.9399999976158142 } ], "ln": 463141 }, { "b": "Cw?Iqellt5B7]Mgj:5UmfAzeM4IRxMvqPO1z/PRYx(!lfvr\u003eQRzdKnhpdnb8mSI{OwP@6kyALCl008Tp2lj-700000000GP2lj-D00000000000000000000000000000B2lj-70000000000uQF:Lmr\u0026xrvqfPVzf6i9A+e/mwnD5Z00000%0mT/kMy=:000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000SS=i001bw0dU)", "n": [ { "c": 3, "d": "Embedded .NET runtime string marker", "i": "metadata/file/format/structured::embedded-dotnet-runtime-string", "o": 521998, "z": 11, "cf": 0.9599999785423279 } ], "ln": 521870 } ], "mol": "O₂(AsC)Md", "sha": "3167a32d075d3c38d0c30d274ff51bcb77a23d7465788e295a3553556403776a", "path": "3167a32d075d3c38d0c30d274ff51bcb77a23d7465788e295a3553556403776a.iso", "risk": 239, "size": 528384, "type": "iso", "facts": { "metrics": { "file": { "size": 528384.0, "entropy": 6.95, "size_bytes": 528384.0 }, "binary": { "overall_entropy": 6.95, "peak_region_bytes": 296960.0, "peak_region_entropy": 7.84 } } }, "traits": [ { "id": "metadata/file/format/iso::iso-dotnet-metadata-marker", "conf": 0.9900000095367432, "crit": 3, "desc": ".NET metadata signature marker", "spans": [ [ 436840, 4 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-resource-loader", "conf": 0.949999988079071, "crit": 3, "desc": ".NET resource loader marker in opaque content", "spans": [ [ 462786, 15 ] ] }, { "id": "metadata/file/format/structured::primary-volume-descriptor", "conf": 1.0, "crit": 2, "desc": "ISO-9660 primary volume descriptor marker", "spans": [ [ 32769, 5 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker", "conf": 0.9399999976158142, "crit": 3, "desc": ".NET reflection marker in opaque content", "spans": [ [ 461339, 17 ], [ 463269, 9 ] ] }, { "id": "metadata/file/format/structured::embedded-dotnet-runtime-string", "conf": 0.9599999785423279, "crit": 3, "desc": "Embedded .NET runtime string marker", "spans": [ [ 521998, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/iso::iso-dotnet-reflection-resource-loader", "atk": "T1027,T1140,T1620", "conf": 0.9900000095367432, "crit": 5, "desc": "ISO .NET reflection resource loader", "spans": [ [ 32769, 5 ], [ 436840, 4 ], [ 461339, 17 ], [ 462786, 15 ], [ 463269, 9 ] ] }, { "id": "objectives/command-and-control/dropper/staging/embedded::iso-dotnet-resource-stager", "atk": "T1027,T1140,T1620", "conf": 0.9900000095367432, "crit": 5, "desc": "ISO stages a .NET resource payload", "spans": [ [ 32769, 5 ], [ 436840, 4 ], [ 461339, 17 ], [ 462786, 15 ], [ 463269, 9 ], [ 521998, 11 ] ] } ] } ] } }